3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe
Size

1.6MB
MD5

80ddb6f51417651437576d9383435502
SHA1

5cc6ffd88863358b71a3a292b81c65c61d552e9b
SHA256

3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890
SHA512

89bb4e6c7690bf5caa3b53d21d8992dcb3eda8bf37a3d9b95ef0d6bd08ed6e5023df8945c67e53d7b1c98fd8352760c3440f48cd94010706b9d5004856aa2886
SSDEEP

49152:MCTrANTgnyX+foZnVCoaf+QRklFH0C4Ca:vaGC/7afVSyn

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2656	3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.tmp

Loads dropped DLL 1 IoCs

pid	Process
2180	3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2656	2180	3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe	30
PID 2180 wrote to memory of 2656	2180	3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe	30
PID 2180 wrote to memory of 2656	2180	3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe	30
PID 2180 wrote to memory of 2656	2180	3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe	30
PID 2180 wrote to memory of 2656	2180	3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe	30
PID 2180 wrote to memory of 2656	2180	3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe	30
PID 2180 wrote to memory of 2656	2180	3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe	30

C:\Users\Admin\AppData\Local\Temp\3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe
"C:\Users\Admin\AppData\Local\Temp\3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\is-8SQUH.tmp\3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8SQUH.tmp\3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.tmp" /SL5="$4001C,1156381,436224,C:\Users\Admin\AppData\Local\Temp\3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-8SQUH.tmp\3720a06601414f75630888bc2fc2d86a77ba871b4e0fcc36e5990e8a3b758890.tmp

Filesize
1.4MB

MD5
6a0f1d71ecf0e1869ce08d3f2ae1baff

SHA1
068df483ccf6f3ac9be0559ec5c5b87fe1a3b6f9

SHA256
798e65b4cf5d09e9e91fcfefd3c86d272205247ab4de8588fe6f5b549702677a

SHA512
e1cc042b03e1dbfddac5df26cbfb8783bc0db693e2059f4ae086fbf187f55300e89f3974cbb9f2ef8ab72c5bd3c6c58fcafdef49f9c19d25e361bff4dabe5e80

Download Submit
memory/2180-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2180-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2180-10-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2656-8-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/2656-12-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download